BookStack/app/Http/Middleware/ApplyCspRules.php

41 lines
899 B
PHP
Raw Normal View History

2021-09-03 18:32:42 -04:00
<?php
namespace BookStack\Http\Middleware;
use BookStack\Util\CspService;
2021-09-03 18:32:42 -04:00
use Closure;
use Illuminate\Http\Request;
class ApplyCspRules
{
protected CspService $cspService;
public function __construct(CspService $cspService)
{
$this->cspService = $cspService;
}
2021-09-03 18:32:42 -04:00
/**
* Handle an incoming request.
*
* @param Request $request
* @param Closure $next
*
* @return mixed
*/
public function handle($request, Closure $next)
{
view()->share('cspNonce', $this->cspService->getNonce());
if ($this->cspService->allowedIFrameHostsConfigured()) {
config()->set('session.same_site', 'none');
}
2021-09-03 18:32:42 -04:00
$response = $next($request);
$cspHeader = $this->cspService->getCspHeader();
$response->headers->set('Content-Security-Policy', $cspHeader, false);
2021-09-03 18:32:42 -04:00
return $response;
}
}